Privacy Policy

1. Who we are

Tolist Japan GK ("we", "us", "our") provides a human-powered travel concierge service in Japan.

Contact: Yu Shimizu, 1-20-10 Higashino, Urayasu-shi, Chiba-ken, 279-0042, Japan, [email protected]

2. What this covers

This policy explains how we collect, use, share and protect personal data when you visit our website, contact us via chat apps (e.g., WhatsApp, Instagram, Email), or purchase our services.

3. Data we collect

• Identity & contact: name, email, phone, country of residence
• Trip details & preferences: dates, areas, dietary needs, accessibility needs
• Communications: messages, call notes, support tickets
• Transactional: plan purchased, payment status (via processor), invoices
• Technical: device, IP, analytics and cookie data (only with consent where required)

4. How we use data (lawful bases)

• Provide and improve our concierge service, make reservations on your behalf (contract)
• Communicate, verify identity, prevent fraud (legitimate interests/contract)
• Analytics and marketing with your consent where required (consent)
• Legal compliance and accounting (legal obligation)

5. Sharing

We share data with service providers under contracts: hosting/CDN, payment processors (e.g., Stripe), analytics/marketing tools (enabled only with consent), and communication platforms. We do not sell personal data.

6. International transfers

Your data may be processed outside your country (including Japan, the US, and the EU). Where required, we use appropriate safeguards such as Standard Contractual Clauses.

7. Retention

Conversation history: up to 24 months; billing records: 7 years; analytics: up to 13 months; or longer if required by law. We then delete or anonymize.

8. Your rights

Subject to your location: access, correction, deletion, objection/restriction, portability, and withdrawal of consent. California residents may opt out of cross-context behavioral advertising. Request at: /privacy-requests or [email protected]

9. Security

We apply encryption in transit, access controls, staff training, and vendor due diligence. No method is 100% secure.

10. Third-party links and messaging apps

When you contact us via WhatsApp/Instagram/Email, those platforms process your data under their own terms and privacy policies.

11. Changes

We'll post updates here and adjust the "Effective" date. Material changes will be notified via email or on-site banner.

12. Contact

[email protected] / 1-20-10 Higashino, Urayasu-shi, Chiba-ken, 279-0042, Japan